Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
veracodeVeracode Vulnerability DatabaseVERACODE:46005
HistoryMar 26, 2024 - 5:37 a.m.

Denial Of Service (DoS)

2024-03-2605:37:36
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
8
jwcrypto
vulnerability
dos
attack
jwe token
validation
length
tokens
processing
memory

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

jwcrypto is vulnerable to Denial Of Service (DoS). The vulnerability is due to there is no proper validation on the length of tokens being processed by JWCrypto in the file jwe.py. This flaw allowing an attacker being able to exploit a high compression ratio in a malicious JWE Token, consuming excessive memory and processing time during token processing.

CPENameOperatorVersion
jwcryptole1.5.5
jwcryptole1.5.5

Related

nessus 6
osv 5
cve 1
almalinux 1
redhat 2
cgr 1
wolfi 1
ubuntucve 1
cvelist 1
nvd 1
redhatcve 1
rocky 2
oraclelinux 2
prion 1
debiancve 1
github 1
ibm 2
nessus
nessus
RHEL 7 : python-jwcrypto (Unpatched Vulnerability)
2024-05-11 00:00:00
Oracle Linux 9 : python-jwcrypto (ELSA-2024-2559)
2024-05-07 00:00:00
RHEL 9 : python-jwcrypto (RHSA-2024:2559)
2024-04-30 00:00:00
osv
osv
Moderate: python-jwcrypto security update
2024-04-30 00:00:00
CVE-2024-28102
2024-03-21 02:52:23
Moderate: python-jwcrypto security update
2024-05-10 14:32:42
cve
cve
CVE-2024-28102
2024-03-21 02:52:23
almalinux
almalinux
Moderate: python-jwcrypto security update
2024-04-30 00:00:00
redhat
redhat
(RHSA-2024:2559) Moderate: python-jwcrypto security update
2024-04-30 11:38:51
(RHSA-2024:3267) Moderate: idm:DL1 and idm:client security update
2024-05-22 10:41:24
cgr
cgr
CVE-2024-28102 vulnerabilities
2024-05-19 03:07:16
wolfi
wolfi
CVE-2024-28102 vulnerabilities
2024-07-01 09:08:36
ubuntucve
ubuntucve
CVE-2024-28102
2024-03-21 00:00:00
cvelist
cvelist
CVE-2024-28102 JWCrypto vulnerable to JWT bomb Attack in `deserialize` function
2024-03-06 21:09:58
nvd
nvd
CVE-2024-28102
2024-03-21 02:52:23
redhatcve
redhatcve
CVE-2024-28102
2024-03-10 09:09:41
rocky
rocky
python-jwcrypto security update
2024-05-10 14:32:42
idm:DL1 and idm:client security update
2024-06-14 13:59:30
oraclelinux
oraclelinux
python-jwcrypto security update
2024-05-07 00:00:00
idm:DL1 and idm:client security update
2024-05-29 00:00:00
prion
prion
Code injection
2024-03-14 22:53:57
debiancve
debiancve
CVE-2024-28102
2024-03-21 02:52:23
github
github
JWCrypto vulnerable to JWT bomb Attack in `deserialize` function
2024-03-06 20:00:56
ibm
ibm
Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities
2024-05-03 19:55:52
Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities
2024-05-03 10:32:27

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON
Related for VERACODE:46005
nessus6osv5cve1almalinux1redhat2cgr1wolfi1ubuntucve1cvelist1nvd1redhatcve1rocky2oraclelinux2prion1debiancve1github1ibm2